Whats new in ISOIEC 27001:2013?
e-Security | Vol: 36-12014
© CyberSecurity Malaysia 2014 - All Rights Reserved
10
A.12 Operations security, A.13 Communications security
A.14 System Acquisition, development and maintenance,
A.15 Supplier relationships, A.16 Information security incident
management, A.17 Information security aspects of
business continuity, and A.18 Compliance.
Refer to Figure 1 for the overall view of the new ISMS requirements and
information security controls in ISO IEC 27001:2013.
Figure 1: Requirements and information security controls in ISOIEC 27001:2013
And lastly, the contents of standard has been revised and improved overall in
the hope that it is better understood by organisations. For example, in ISO
IEC 27001:2005 version, the topics for conducting ISMS review were scattered
in various clauses, but in this new standard, the topics were grouped
together under Clause 9 Performance Evaluation.
3. How to migrate to the new ISOIEC 27001:2013?
Firstly, organisations are recommended to send their relevant personnel for
training sessions. Personnel who are in charge of ISMS should attend
relevant training sessions to have a better understanding of these new
requirements in ISOIEC 27001:2013. Examples of the relevant training
programmes are Introduction to ISO IEC 27001:2013 and Migration to ISO
IEC 27001:2013.
Next, organisations which have implemented ISOIEC 27001:2005
are advised to conduct a thorough gap analysis. This is due to several
requirements and controls that have been added, reviewed or deleted in
the revised ISOIEC 27002:2013. By conducting a thorough gap analysis, the
organisation will be able to assess the gap between the current implemented
ISMS and the new ISOIEC 27001; and understand additional actions that are
needed to be taken to comply with the new ISOIEC 27001. They will also be
able to develop a detailed plan with timeline for the ISOIEC 27001:2013
migration.
Furthermore, organisations should review their current documents; as
most probably they need to change and update their documents to suit to ISO
IEC 27001:2013. One document that must be updated is the Statement of
Applicability SOA. An SOA is a document describing the control objectives and
controls that are relevant and applicable to the organisations ISMS. SOA lists
all information security controls that organisations have implemented and
should be implementing. If there are new information security controls
from ISOIEC 27002:2013 that should be implemented, the SOA should
be updated to reflect this change. Furthermore, there are also a possibility
for organisations to develop new policy
e-Security | Vol: 36-12014
© CyberSecurity Malaysia 2014 - All Rights Reserved
11
and procedure with regards to the new ISOIEC 27001.
Finally, the necessity to conduct adequate awareness briefings to all
relevant employees and external. The purpose is to educate employees on
the changes and brief them on their additional roles and responsibilities
if any. Awareness to external parties should involve vendors and contractors.